From c849e690925cb656b8c00ccbeda12aeab22c2fdd Mon Sep 17 00:00:00 2001 From: Elrond Date: Thu, 2 Jun 2011 14:25:31 +0200 Subject: [PATCH] Check for edit permission. You need to own the media, or be an admin to use the edit form. As simple as that, for now. --- mediagoblin/edit/views.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/mediagoblin/edit/views.py b/mediagoblin/edit/views.py index 050ece4e..e5dccc81 100644 --- a/mediagoblin/edit/views.py +++ b/mediagoblin/edit/views.py @@ -5,9 +5,22 @@ from webob import Response, exc from mediagoblin.edit import forms from mediagoblin.decorators import require_active_login, get_media_entry_by_id + +def may_edit_media(request, media): + """Check, if the request's user may edit the media details""" + if media['uploader'] == request.user['_id']: + return True + if request.user['is_admin']: + return True + return False + + @get_media_entry_by_id @require_active_login def edit_media(request, media): + if not may_edit_media(request, media): + return exc.HTTPForbidden() + form = forms.EditForm(request.POST, title = media['title'], slug = media['slug'],